A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: jenkins

Published: 2021-03-30T11:10:40

Updated: 2024-08-03T18:16:23.782Z

Reserved: 2021-01-04T00:00:00

Link: CVE-2021-21637

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-03-30T12:16:10.907

Modified: 2024-11-21T05:48:44.670

Link: CVE-2021-21637

cve-icon Redhat

No data.